CVE-2026-80923: Linux Kernel xhci dbgtty Use-After-Free

CVE-2026-80923 Overview

CVE-2026-80923 is a use-after-free vulnerability in the Linux kernel's xHCI (Extensible Host Controller Interface) debug capability TTY (xhci-dbgtty) driver. The flaw resides in the initialization path of the debug TTY subsystem. When tty_register_driver() fails during module initialization, the code releases the driver reference but does not reset the global dbc_tty_driver pointer to NULL. On subsequent module unload, dbc_tty_exit() checks only whether the pointer is non-NULL before invoking tty_unregister_driver(), operating on already-freed memory.

Critical Impact
A dangling pointer in dbc_tty_driver causes tty_unregister_driver() to be called on freed memory during module unload, leading to a kernel use-after-free condition.

Affected Products

Linux kernel xhci-dbgtty driver (xHCI Debug Capability TTY subsystem)
Kernel branches receiving backports referenced by commits 01b7bc0, 0d0faf3, 0e469b9, 33ed35c, 43635ff, 943f976, a916fa6, and eaca281
Systems that load and unload the xhci_hcd module where debug capability initialization can fail

Discovery Timeline

2026-09-09 - CVE-2026-80923 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-80923

Vulnerability Analysis

The vulnerability is a use-after-free [CWE-416] in the xHCI debug capability TTY driver initialization path. During xhci_hcd_init(), the kernel calls xhci_dbc_init(), which in turn calls dbc_tty_init(). Inside dbc_tty_init(), if tty_register_driver() returns an error, the code invokes tty_driver_kref_put() to release the driver reference. The freed driver structure is not zeroed out from the global dbc_tty_driver pointer.

The return value from xhci_dbc_init() is not propagated, so module initialization continues normally. When the module is later unloaded, xhci_hcd_fini() calls xhci_dbc_exit(), which invokes dbc_tty_exit(). That function gates cleanup on if (dbc_tty_driver) being non-NULL, then calls tty_unregister_driver() on the dangling pointer, dereferencing freed memory.

Root Cause

The root cause is missing state cleanup on an error path. After tty_driver_kref_put() releases the reference, the global dbc_tty_driver is left pointing at freed memory instead of being reset to NULL. The exit routine's non-NULL check is therefore an unreliable indicator of whether the driver was successfully registered.

Attack Vector

Exploitation requires triggering an xhci-dbgtty registration failure and a subsequent module unload. This is primarily a kernel stability defect. Practical impact depends on kernel allocator behavior after the freed driver structure is reused, which could produce memory corruption, kernel oops, or, under controlled reallocation of the freed slab object, further exploitation primitives. Local privileges to load and unload kernel modules are typically required.

See the upstream fixes in the kernel git tree, including commits 01b7bc0, 0e469b9, and eaca281, for the code changes that clear the global pointer on failure.

Detection Methods for CVE-2026-80923

Indicators of Compromise

Kernel log entries showing tty_register_driver failures associated with xhci-dbgtty or dbc during boot or module load.
Kernel oops, panic, or KASAN use-after-free reports referencing dbc_tty_exit, tty_unregister_driver, or xhci_dbc_exit on module unload.
Unexpected xhci_hcd module reload cycles followed by kernel instability on the same host.

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) in test and staging kernels to surface use-after-free reads and writes in the xHCI debug TTY paths.
Collect dmesg and journal logs centrally and alert on WARN, BUG, or KASAN messages mentioning dbc_tty or xhci_dbc.
Correlate xhci_hcd module load and unload events with subsequent kernel fault signatures to identify reproducible triggers.

Monitoring Recommendations

Forward kernel ring buffer output from Linux hosts to a central logging pipeline for pattern matching on xHCI debug driver errors.
Track running kernel versions across the fleet against the fixed commits to prioritize patch rollout.
Monitor for unauthorized insmod, modprobe, or rmmod activity involving xhci_hcd in production environments.

How to Mitigate CVE-2026-80923

Immediate Actions Required

Apply the upstream kernel patches that reset dbc_tty_driver to NULL on tty_register_driver() failure. Reference the fixes in the kernel git tree, for example commit 01b7bc0.
Update to a distribution kernel that includes the backported fix for your stable branch.
Restrict permissions to load and unload kernel modules to trusted administrators only.

Patch Information

The fix has been merged across multiple stable branches. Backport commits include 01b7bc0, 0d0faf3, 0e469b9, 33ed35c, 43635ff, 943f976, a916fa6, and eaca281. Confirm inclusion by checking your distribution's kernel changelog for the referenced commit hashes.

Workarounds

Avoid unloading the xhci_hcd module on affected kernels, particularly on hosts where the xHCI debug capability initialization has previously reported failure.
Disable the xHCI Debug Capability in kernel configuration (CONFIG_USB_XHCI_DBGCAP) where the debug TTY is not required.
Use module loading policies, such as modprobe blacklists or Lockdown mode, to prevent untrusted local users from triggering the vulnerable load/unload sequence.

bash

# Verify running kernel version and check for the fix
uname -r

# Check whether xHCI Debug Capability is enabled in the running kernel
grep CONFIG_USB_XHCI_DBGCAP "/boot/config-$(uname -r)"

# Restrict module load/unload to root only (default) and audit usage
auditctl -w /sbin/insmod  -p x -k module_load
auditctl -w /sbin/rmmod   -p x -k module_unload
auditctl -w /sbin/modprobe -p x -k module_load